certctl: replace hardcoded uses of /usr/local

Use the new user.localbase sysctl here as well, to reduce the number of
hardcoded localbase by one (1).

MFC after: 3 days (note: just use a literal /usr/local default)